From 3dcb4709cb7b9f3dbb3a64165318740bb0f628d2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 13 Aug 2026 08:53:39 +0000
Subject: [PATCH] Use trusted publishing for NuGet

Co-authored-by: wforney <79032+wforney@users.noreply.github.com>
---
 .github/workflows/release.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57070d8..8ceb073 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,7 +89,8 @@ jobs:
     name: Publish to Nuget
     runs-on: windows-latest
     permissions:
-      packages: write
+      contents: read
+      id-token: write
     steps:
     - name: Download built project
       uses: actions/download-artifact@v5
@@ -101,5 +102,11 @@ jobs:
       with:
         dotnet-version: 10.0.x
 
+    - name: Authenticate with NuGet.org
+      id: login
+      uses: NuGet/login@v1
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push Package to NuGet
-      run: dotnet nuget push --api-key ${{secrets.NUGET_API_KEY}} --source "https://api.nuget.org/v3/index.json" *.nupkg
+      run: dotnet nuget push --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source "https://api.nuget.org/v3/index.json" *.nupkg